Build agent controls in-house when your needs are narrow, your agents are few and your team has time to maintain them. Buy or adopt a maintained product when the number of agents grows, the protocols keep changing, or you need audit evidence you cannot afford to produce by hand. Most teams end up with a mix.
What "controls" means here
For this decision, controls are the pieces that enforce governance: an inventory of agents and tool servers, access scoping, approval rules, logging, and a way to stop an agent. You can write each one yourself. The question is who will keep it working.
Six tests
| Test | Leans build | Leans buy |
|---|---|---|
| How many agents and tool servers? | A handful | Dozens, growing |
| How stable is your setup? | One assistant, one tool set | Many clients and servers, frequent changes |
| Who maintains it? | A named engineer with time | Nobody has spare time |
| What evidence do you need? | Internal review only | Auditors or customers will ask |
| How fast must you move? | Weeks are fine | Need coverage this quarter |
| How special are your needs? | Unusual internal systems | Common developer tools |
Score each row honestly. If four or more point one way, that is your answer.
The hidden costs of building
Writing the first version is the cheap part. The MCP specification carries many requirements for servers and clients, from token audience checks to consent flows to blocking private address ranges, and it is revised over time. Someone must read each revision and update your code. Logging formats, approval screens and identity handling all need tests and an owner.
The specification also advises against hand-rolled IP validation because encoding tricks defeat custom parsers. That is a small example of why home-made controls can have gaps that are hard to see from the inside.
The hidden costs of buying
A product adds a dependency and a data flow. You need to know what leaves your environment, how the product fails, and how you would leave. Ask these before signing, using the eight questions. Check whether rules and logs can be exported so you are not trapped.
A sensible mix
Many teams buy the parts that need constant upkeep or evidence, such as discovery, scanning and audit records, and build the parts that are specific to them, such as an approval flow wired into their own chat tool. Write down the line between the two so a future you can revisit it.
Revisit on a schedule
Put a date in the calendar, perhaps twelve months out, to repeat the six tests. What was right for three agents may be wrong for thirty.
Quick check
Is open source a middle path?
Often, yes. You get maintained code but still own deployment and upgrades, so apply the same maintenance test.
Can we start by building and buy later?
Yes, if you keep your rules in a portable format and log in a standard shape, which makes a later move far easier.
Safeguard offers asset discovery, policies and gates, and an MCP Guardrail as GA capabilities, and a free scan shows what it finds in your repositories.
Sources
Last reviewed: 19 October 2026.
